Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
This rule identifies accounts that create or modify 10 or more files, each larger than 200MB, within a one-hour period. This behavior can be indicative of data exfiltration, staging of large files, or other suspicious bulk file operations.
Detects the execution of the MinIO client (mc) with insecure connection parameters, indicating potential automated data exfiltration to S3-compatible storage by threats like BLUERABBIT. The rule specifically looks for the 'alias', 'set', and '--insecure' arguments in the process command line.
This rule detects outbound Server Message Block (SMB) communications from internal devices to external (non-private) IP addresses. It specifically looks for connections on ports 137, 138, 139, and 445. The rule then aggregates these events over 10-minute intervals and flags devices that have more than 5 such SMB connections to distinct external IPs, indicating potential data exfiltration or unauthorized external communication.
Detects outbound network activity to the known malicious domain sfrclak.com or IP address 142.11.206.73. This behavior may indicate malware beaconing, command-and-control communication, or interaction with attacker-controlled infrastructure.
This rule detects suspicious network connections originating from internal IP addresses to common service ports (DNS, SMB, RDP, WinRM) on remote, non-internal IP addresses. It flags instances where a single process on a device makes 10 or more such connections within an hour, which could indicate reconnaissance, lateral movement, or data exfiltration attempts.
Detects the execution of WinSCP or Rclone binaries, which are heavily utilized by threat actors like UNC3753 as portable utilities to rapidly exfiltrate staged data.
Detects outbound network connections to known Command and Control (C2) IP addresses associated with the OP-512 threat actor, which are used as fallback infrastructure, including Meterpreter. This rule specifically looks for connections to '43.160.202.246' and '140.206.161.227'.
This rule detects potential data exfiltration to a GitLab repository. It specifically looks for HTTP POST requests to gitlab.com with the URI containing '/git-receive-pack' and a data size greater than 10KB. This pattern is indicative of a 'git push' operation, which could be used to exfiltrate data.
This rule detects potential data exfiltration attempts via a GitHub repository push. It specifically looks for HTTP POST requests to 'github.com' with the URI '/git-receive-pack' and a data size greater than 10000 bytes. This pattern is indicative of a 'git push' operation, which could be used to upload sensitive data to a public or controlled GitHub repository.
This rule detects potential data exfiltration of USB drive contents over SSH using SCP. It triggers when TCP traffic on port 22 (SSH) from the home network to the home network contains the string "/dev/sd" (case-insensitive) and the data size is greater than 65000 bytes. This combination suggests that a file from a Linux-like USB device (often mounted as /dev/sdX) is being transferred out via SCP.
This rule detects scheduled data transfers occurring at off-hours, characterized by a large data size (greater than 65000 bytes) in TCP traffic flowing from the home network to any destination. It uses a thresholding mechanism to alert if 100 such transfers are observed within a 300-second window from the same source.
This rule detects network traffic duplication, specifically looking for the GRE (Generic Routing Encapsulation) protocol (IP protocol 47) being used in a way that suggests traffic mirroring via SPAN or TAP devices. The rule triggers if 10 or more GRE packets are observed from a single source IP within a 30-second window, flowing from a client to a server.
This rule detects potential data exfiltration over an alternate network medium by monitoring TCP traffic from the home network to any destination. It triggers an alert if the data size of an established connection exceeds 10000 bytes and if this occurs 20 times within a 60-second window from the same source IP address. This pattern suggests a large volume of data being transferred out of the network, which could indicate exfiltration.
Detects command line activity attempting to push, commit, or create repositories containing specific Miasma exfiltration signatures, often associated with the Shai-Hulud malware variant. This rule looks for distinct string patterns in process command lines that indicate the use of Miasma for data exfiltration to code repositories.
Detects Node.js or Bun processes making network connections to the GitHub API. This rule is designed to identify potential exfiltration attempts, specifically referencing the Miasma campaign which spoofs a 'python-requests/2.31.0' User-Agent to evade network detection while exfiltrating credentials to api.github.com/repos/.
This rule detects large data transfers over FTP, specifically looking for FTP data connections (flow:to_server,established) where the data size exceeds 65000 bytes. It uses a threshold of 10 such transfers within 60 seconds from the same source to trigger an alert, indicating potential data exfiltration. This aligns with MITRE ATT&CK technique T1048.003, which involves exfiltrating data over FTP.
Monitors for network connections originating from the VSCode extension host process to GitHub API endpoints immediately following a new extension installation. This may indicate token exfiltration or repository enumeration from a malicious extension.
This rule detects an unusually high volume of object close operations (Event ID 4658) by a single user on a single computer within a one-hour window. This activity could indicate various malicious behaviors, including data collection for exfiltration, attempts to delete numerous files, or resource exhaustion attacks.
This rule detects devices exhibiting high volume outbound network traffic, specifically more than 10MB of data transferred across more than 100 sessions to a single remote IP address within a one-minute window. This behavior can be indicative of data exfiltration, unauthorized data transfer, or other suspicious network activity.
This rule detects instances where a single remote IP address exhibits a high number of idle network events (more than 200 idle events) and a high total number of network events (more than 500 total events) within a one-minute interval. This pattern can be indicative of Command and Control (C2) communication, where an adversary establishes a connection and then waits for commands, or data exfiltration, where data is sent in bursts with idle periods in between. It highlights unusual network communication patterns that might suggest malicious activity.
This rule detects suspicious network connections originating from internal IP addresses to common service ports (DNS, SMB, RDP, WinRM) on remote, non-internal IP addresses. It flags instances where a single process on a device makes 10 or more such connections within an hour, which could indicate reconnaissance, lateral movement, or data exfiltration attempts.
Page 78 of 124